Hackers stole DreamHost customer files and inboxes during months-long attack
- ID
- 43114
- Status
- summarized
- Published
- 05 Nov 2026, 4:36 AM
- Fetched
- 05 Nov 2026, 5:16 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/11/04/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 5.5
- Created
- 05 Nov 2026, 5:16 AM
- Tags
- Audience
- developersvibe_codersstartup_founders
What happened
DreamHost confirmed hackers accessed customer files and inboxes in a breach that began in August and was only disclosed last Thursday after causing a multi-day outage and password resets. The entry point was an unspecified vulnerability in DreamHost's file manager, and attackers stole session tokens — which keep users logged in without re-entering a password — not just credentials. DreamHost says affected customers are "well under 10%" of its 400,000 paying customers but declined to give a number, describe the vulnerability, or explain the months-long detection gap; it says the flaw is unrelated to recent PHP vulnerabilities.
Why it matters
If you or a client site sits on DreamHost — or any shared host — a password reset alone may not be enough: stolen session tokens let an attacker stay authenticated as you, so the practical step is to kill active sessions and rotate any API keys, SSH keys, or app secrets stored in files or mail on that host, not just change the login password. With up to roughly 40,000 accounts implied by "well under 10%" of 400,000, treat any DreamHost-hosted mailbox as a possible source of leaked credentials for the third-party services those addresses reset.
Discussion angle
Session-token theft defeats the usual "just reset your password" advice — worth walking through what an actual revoke-sessions-and-rotate-secrets checklist looks like for anyone hosting on shared infrastructure, and whether hosts should be required to publish affected-account counts.